A critical code injection vulnerability in FreshRSS allows authenticated administrators to achieve remote code execution and compromise sensitive user data.

The flaw is categorized as CWE-94: Improper Control of Generation of Code. An authenticated administrator can modify the application update URL to a malicious endpoint, resulting in arbitrary code execution on the host server during the update process.

Successful exploitation of this vulnerability grants an attacker full control over the FreshRSS instance. This permits the exfiltration of hashed passwords, potential theft of plaintext credentials, and total system compromise. Given the CVSS score of 7.2, this represents a high-severity threat to data confidentiality, integrity, and availability.

Immediate Action: Upgrade all FreshRSS instances to version 1.26.2 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review administrative access logs for unauthorized changes to update settings or anomalous server-side script execution.

Compensating Controls: Restrict administrative access to trusted internal IP addresses and implement strict file integrity monitoring on the web directory to detect unauthorized modifications.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the integrity of the FreshRSS host server. Administrators must prioritize the upgrade to version 1.26.2 to eliminate the injection vector. Given the potential for total system takeover, failure to patch may lead to a full breach of the application environment.